spectmorph.lv2

maintainer milkii · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The sources are from the project's official domain (spectmorph.org) and contain the project's own source code and data; building from these is standard and safe despite the host not being on a whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The sources are from the project's official domain (spectmorph.org) and contain the project's own source code and data; building from these is standard and safe despite the host not being on a whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("http://www.spectmorph.org/files/releases/spectmorph-${pkgver}.tar.bz2"
PKGBUILD:21 "http://spectmorph.org/files/instruments/spectmorph-instruments-${pkgver}.tar.xz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: milkii on freenode
    
      2# Maintainer: David Runge <dvzrv@archlinux.org>
    
      3
    
      4pkgname=spectmorph.lv2
    
      5pkgver=0.5.1
    
      6pkgrel=1
    
      7pkgdesc="Analyze samples of musical instruments and combine them (morphing)"
    
      8arch=('x86_64')
    
      9url="http://spectmorph.org/"
    
      10license=('LGPL3')
    
      11groups=('lv2-plugins' 'pro-audio' 'vst-plugins')
    
      12depends=('cairo' 'gcc-libs' 'glib2' 'glibc' 'libao' 'libglvnd' 'libx11' 'zlib')
    
      13makedepends=('fftw' 'freetype2' 'jack' 'lv2' 'libsndfile' 'qt5-base')
    
      14checkdepends=('lv2lint')
    
      15optdepends=('jack: for smjack and smsampleedit'
    
      16            'qt5-base: for sminspector and smsampleedit')
    
      17provides=('libspectmorphjack.so' 'libspectmorphgui.so' 'libspectmorphglui.so'
    
      18'libspectmorph.so')
    
      19conflicts=(spectmorph)
    
      20source=("http://www.spectmorph.org/files/releases/spectmorph-${pkgver}.tar.bz2"
    
      21        "http://spectmorph.org/files/instruments/spectmorph-instruments-${pkgver}.tar.xz")
    
      22sha512sums=('db5770266d1cdcb1dc64c369fc8ea9580741a8d7d766e3c298fdf175db4cf5daf2abb55213e3f6e9a93f42e103c86eb3b3dce10f2e945441c3048e847c811b01'
    
      23            '7cfb94b312a9d3f73dd0c87185cd398fdb3373ee4ec2e904033a1cbaa43296cd43a247dd81365cecd07609354c0bbd15cf2ee379fb36b890736f0cff1e7bc689')
    
      24
    
      25prepare() {
    
      26  cd "spectmorph-$pkgver"
    
      27  # Patch: GCC 16 requires explicit #include <cstdint> for uint*_t
    
      28  sed -i '/#include <vector>/a #include <cstdint>' lib/smutils.hh
    
      29  sed -i '/#include <vector>/a #include <cstdint>' lib/smoutfile.hh
    
      30  sed -i '/#include <assert.h>/a #include <cstdint>' lib/smoutfile.cc
    
      31  autoreconf -vfi
    
      32}
    
      33
    
      34build() {
    
      35  cd "spectmorph-$pkgver"
    
      36  ./configure --prefix=/usr \
    
      37              --with-lv2 \
    
      38              --without-jack \
    
      39              --without-qt
    
      40  make
    
      41}
    
      42
    
      43check() {
    
      44  cd "spectmorph-$pkgver"
    
      45  cp -v lv2/.libs/*.so lv2/
    
      46  LV2_PATH="${PWD}" lv2lint "http://spectmorph.org/plugins/spectmorph" || echo "Known failing tests: https://github.com/swesterfeld/spectmorph/issues/8"
    
      47  rm -v lv2/*.so
    
      48}
    
      49
    
      50package() {
    
      51  depends+=('libfftw3f.so' 'libfftw3f_threads.so' 'libfreetype.so'
    
      52  'libsndfile.so')
    
      53  cd "spectmorph-$pkgver"
    
      54  make DESTDIR="$pkgdir/" install
    
      55  # standard instruments
    
      56  install -vDm 644 ../instruments/standard/* \
    
      57    -t "${pkgdir}/usr/share/spectmorph/instruments/standard/"
    
      58  # docs
    
      59  install -vDm 644 {AUTHORS,DESIGN,NEWS,README.md,TODO} \
    
      60    -t "${pkgdir}/usr/share/doc/spectmorph/"
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -24,6 +24,10 @@
 
 prepare() {
   cd "spectmorph-$pkgver"
+  # Patch: GCC 16 requires explicit #include <cstdint> for uint*_t
+  sed -i '/#include <vector>/a #include <cstdint>' lib/smutils.hh
+  sed -i '/#include <vector>/a #include <cstdint>' lib/smoutfile.hh
+  sed -i '/#include <assert.h>/a #include <cstdint>' lib/smoutfile.cc
   autoreconf -vfi
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 19:31:13	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1